PT-2025-12047 · Gradio App · Gradio

Published 2025-03-20 · Updated 2025-10-07 · CVE-2024-10569

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions gradio-app/gradio version git 98cbcae

Description A vulnerability in the dataframe component of gradio-app/gradio allows for a zip bomb attack. The component uses pd.read csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server crash and causing a denial of service.

Recommendations As a temporary workaround, consider disabling the pd.read csv function until a patch is available. Restrict access to the dataframe component to minimize the risk of exploitation. Avoid using compressed files in the input values for the dataframe component until the issue is resolved.

Exploit

Fix

DoS

Weakness Enumeration

CWE-475

Related Identifiers

CVE-2024-10569

GHSA-7XMC-VHJP-QV5Q

Affected Products

Gradio

References · 9

• 🔥 https://huntr.com/bounties/7192bcbb-08a3-4d22-a321-9c6d19dbfc74 · Exploit
• https://osv.dev/vulnerability/CVE-2024-10569 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10569 · Security Note
• https://osv.dev/vulnerability/GHSA-7xmc-vhjp-qv5q · Vendor Advisory
• https://github.com/gradio-app/gradio · Note
• https://github.com/gradio-app/gradio/blob/98cbcaef827de7267462ccba180c7b2ffb1e825d/gradio/components/dataframe.py#L263 · Note
• https://t.me/cvenotify/115543 · Telegram Post
• https://twitter.com/CVEnew/status/1902671047637475786 · Twitter Post
• https://t.me/cveNotify/137735 · Telegram Post